User talk:Jeff Williams - Revision history

Jeff Williams at 19:53, 5 November 2009

2009-11-05T19:53:01Z

Jeff Williams at 19:44, 5 November 2009

2009-11-05T19:44:24Z

Jeff Williams at 19:43, 5 November 2009

2009-11-05T19:43:54Z

Jeff Williams at 19:42, 5 November 2009

2009-11-05T19:42:03Z

Jeff Williams: Replacing page with '{{#widget:MyWeather |zipcode=73135 |title=Weather in Oklahoma City }}'

2009-06-24T21:17:53Z

Replacing page with '{{#widget:MyWeather |zipcode=73135 |title=Weather in Oklahoma City }}'

Jeff Williams at 20:57, 17 February 2009

2009-02-17T20:57:49Z

Jeff Williams at 20:52, 17 February 2009

2009-02-17T20:52:45Z

Jeff Williams at 20:52, 17 February 2009

2009-02-17T20:52:01Z

Jeff Williams at 20:24, 17 February 2009

2009-02-17T20:24:43Z

Jeff Williams at 20:20, 17 February 2009

2009-02-17T20:20:28Z

← Older revision		Revision as of 19:53, 5 November 2009
Line 1:		Line 1:
−	~~{{#widget:MyWeather~~	+
−	~~\|zipcode=73135~~
−	~~\|title=Weather in Oklahoma City~~
−	}}

	<img src="javascript:alert(1)" />		<img src="javascript:alert(1)" />

← Older revision		Revision as of 19:44, 5 November 2009
Line 4:		Line 4:
	}}		}}

−	;Injecting DOWN:The less common way to perform XSS injection is to introduce a code subcontext without closing the current context. For example, if you change <img src="...UNTRUSTED DATA HERE..." /> to <img src="javascript:alert(1)" /> you do not have to escape the HTML attribute context. Instead, you introduce context that allows scripting within the src attribute. Another example is the expression() functionality in CSS properties. Even though you may not be able to escape a quoted CSS property to inject up, you may be able to introduce something like xss:expression(document.write(document.cookie)) without ever leaving the current context.	+	<img src="javascript:alert(1)" />

← Older revision		Revision as of 19:43, 5 November 2009
Line 4:		Line 4:
	}}		}}

−	<img src="javascript:alert(1)	+	;Injecting DOWN:The less common way to perform XSS injection is to introduce a code subcontext without closing the current context. For example, if you change <img src="...UNTRUSTED DATA HERE..." /> to <img src="javascript:alert(1)" /> you do not have to escape the HTML attribute context. Instead, you introduce context that allows scripting within the src attribute. Another example is the expression() functionality in CSS properties. Even though you may not be able to escape a quoted CSS property to inject up, you may be able to introduce something like xss:expression(document.write(document.cookie)) without ever leaving the current context.

← Older revision		Revision as of 19:42, 5 November 2009
Line 3:		Line 3:
	\|title=Weather in Oklahoma City		\|title=Weather in Oklahoma City
	}}		}}
		+
		+	<img src="javascript:alert(1)

@@ Line 1: / Line 1: @@
-<div align="right"><owaspbanner/></div>
+{{#widget:MyWeather
-<div style="font-size:7pt;text-align:right"><b>[http://www.owasp.org/index.php/Advertising Ad Space Available for 2009]</b>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</div>
+|zipcode=73135
+|title=Weather in Oklahoma City
-<!-- Header -->
+}}

@@ Line 33: / Line 33: @@
 |} <!-- End Banner -->
 {|style="width:100%;background:none;"
@@ Line 46: / Line 48: @@
 <!-- Start of right-column -->
-|class="MainPageBG" style="width:50%;border:1px solid #cedff2;background-color:#f5faff;vertical-align:top"|<p><owaspannounce/></p>
+|class="MainPageBG" style="width:50%;border:1px solid #cedff2;background-color:#f5faff;vertical-align:top"|{{Main Right Panel}}
 <!-- End of Main Content -->

@@ Line 46: / Line 46: @@
 <!-- Start of right-column -->
-|class="MainPageBG" style="width:50%;border:1px solid #cedff2;background-color:#f5faff;vertical-align:top"|<owaspannounce/>
+|class="MainPageBG" style="width:50%;border:1px solid #cedff2;background-color:#f5faff;vertical-align:top"|Mp><owaspannounce/></p>
 <!-- End of Main Content -->

← Older revision		Revision as of 20:24, 17 February 2009
Line 1:		Line 1:
−	~~Please send me email @ jeff~~.~~williams@~~owasp.org	+	<div align="right"><owaspbanner/></div>
		+	<div style="font-size:7pt;text-align:right"><b>[http://www.owasp.org/index.php/Advertising Ad Space Available for 2009]</b>     </div>
		+
		+	<!-- Header -->
		+
		+	{\|style="width:100%;background-color:#ececec;border:1px solid #ccc"
		+	\|style="width:56%;color:#000"\|
		+
		+	{\|style="width:280px;border:solid 0px;background:none"
		+	\|-
		+	\|style="width:280px;text-align:center;color:#000" \|
		+	<div style="font-size:162%;border:none;margin: 0;color:#000">'''Welcome to [[About The Open Web Application Security Project\|OWASP]]'''</div>
		+	<div style="top:+0.2em;font-size: 95%">the free and open application security community</div>
		+	\|}
		+
		+	<!-- Special Links -->
		+	\|style="width:110px;font-size:95%;color:#000"\|
		+	*[[:Category:OWASP Top Ten Project\|Top Ten]]
		+	*[[:Category:OWASP WebGoat Project\|WebGoat]]
		+	*[[:Category:OWASP WebScarab Project\|WebScarab]]
		+	\|style="width:110px;font-size:95%"\|
		+	*[[:Category:OWASP_Enterprise_Security_API\|ESAPI]]
		+	*[[:Category:OWASP_Application_Security_Verification_Standard_Project \|ASVS]]
		+	*[[:Category:OWASP_AntiSamy_Project\|AntiSamy]]
		+	\|style="width:180px;font-size:95%"\|
		+	*[[:Category:OWASP Guide Project\|Development Guide]]
		+	*[[:Category:OWASP Code Review Project\|Code Review Guide]]
		+	*[[:Category:OWASP Testing Project\|Testing Guide]]
		+	\|style="width:110px;font-size:95%"\|
		+	*[[:Category:OWASP CLASP Project\|CLASP]]
		+	*[[:Category:OWASP Legal Project\|Contracting]]
		+	*'''[[:Category:OWASP_Project\|More...]]'''
		+
		+	\|} <!-- End Banner -->
		+
		+	{\|style="width:100%;background:none;"
		+	\|style="font-size:95%;text-align:left;color:#000"\|[[About The Open Web Application Security Project\|About]] '''·''' [[Searching\|Searching]] '''·''' [[Tutorial\|Editing]] '''·''' [[How to add a new article\|New Article]] '''·''' [[OWASP Categories]]
		+	\|style="font-size:95%;padding:10px 0;margin:0px;text-align:right;color:#000"\| [[Special:Statistics\|Statistics]] '''·''' [http://www.owasp.org/index.php?title=Special:Recentchanges&limit=100&hidebots=0 Recent Changes]
		+	\|}
		+
		+	<!-- Main Content -->
		+	{\|style="width:100%;border-spacing:8px;margin:0px -8px"
		+
		+	<!-- Start of left-column -->
		+	\|class="MainPageBG" style="width:50%;border:1px solid #cedff2;background-color:#f5faff;vertical-align:top"\|{{Main Left Panel}}
		+
		+	<!-- Start of right-column -->
		+	\|class="MainPageBG" style="width:50%;border:1px solid #cedff2;background-color:#f5faff;vertical-align:top"\|<owaspannounce/>
		+
		+	<!-- End of Main Content -->
		+	\|}
		+
		+	<!-- Member Area -->
		+
		+	{{Template:OWASP Members Horizontal}}
		+
		+
		+	__NOTOC__ __NOEDITSECTION__
		+

	<owaspannounce/>		<owaspannounce/>

← Older revision		Revision as of 20:20, 17 February 2009
Line 1:		Line 1:
	Please send me email @ jeff.williams@owasp.org		Please send me email @ jeff.williams@owasp.org
		+
		+	<owaspannounce/>